From 77db2e30fed5fda02571acf05e58bd5a22e0d77f Mon Sep 17 00:00:00 2001
From: chen21019 <chen21019@gmail.com>
Date: Wed, 26 Aug 2026 15:37:31 +0800
Subject: [PATCH] security: prove openpgp is not shipped

---
 SECURITY.md           |  4 ++++
 scripts/validate      | 14 ++++++++++++++
 security/openvex.json | 22 ++++++++++++++++++++++
 3 files changed, 40 insertions(+)
 create mode 100644 security/openvex.json

diff --git a/SECURITY.md b/SECURITY.md
index 0444898..1385c8a 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -21,3 +21,7 @@ Report suspected vulnerabilities through this repository's private security advi
 The source tree and shipped CGO-disabled product binary must contain no Critical or High vulnerability and no secret. The disposable Ubuntu builder is also scanned, but is not shipped or run as the product.
 
 Critical or High records in the builder are accepted only when every record is an unfixed `affected` finding for the Ubuntu `linux-libc-dev` package. That package contains user-space API headers needed by GCC and Go race tests, not the vulnerable Linux kernel implementation. The gate reports the raw count and fails closed for any other package, fixed finding, status, package URL, or secret. This categorical rule follows the build boundary and does not require a version-specific list that becomes stale on each Ubuntu package refresh.
+
+## Go module applicability
+
+[`security/openvex.json`](security/openvex.json) records the reviewed `GO-2026-5932` applicability decision. The advisory is limited to the discontinued `golang.org/x/crypto/openpgp` package. Host Provisioner uses maintained SSH packages from the same module; the source gate enumerates the complete package graph and fails if `openpgp` becomes reachable or appears in the vendored tree. The VEX product identity is pinned to the resolved module version and must be updated whenever that version changes.
diff --git a/scripts/validate b/scripts/validate
index d546ed0..e4c23cf 100755
--- a/scripts/validate
+++ b/scripts/validate
@@ -27,6 +27,20 @@ if grep -R -n -E 'GO111MODULE=off|GO15VENDOREXPERIMENT' Dockerfile.dapper .githu
 fi
 go list -mod=vendor -deps ./... >/dev/null
 
+crypto_version=$(go list -mod=vendor -m -f '{{.Version}}' golang.org/x/crypto)
+grep -F -- "\"@id\": \"pkg:golang/golang.org/x/crypto@${crypto_version}\"" security/openvex.json >/dev/null || {
+  echo 'OpenVEX x/crypto identity does not match the resolved module.' >&2
+  exit 1
+}
+if go list -mod=vendor -deps ./... | grep -F 'golang.org/x/crypto/openpgp'; then
+  echo 'Vulnerable openpgp package is reachable.' >&2
+  exit 1
+fi
+if test -d vendor/golang.org/x/crypto/openpgp; then
+  echo 'Vulnerable openpgp package is present in the vendored tree.' >&2
+  exit 1
+fi
+
 echo Running: go vet
 go vet ./...
 echo Checking: gofmt
diff --git a/security/openvex.json b/security/openvex.json
new file mode 100644
index 0000000..a80254f
--- /dev/null
+++ b/security/openvex.json
@@ -0,0 +1,22 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/PastureStack/host-provisioner/security/openvex/2026-08-26",
+  "author": "PastureStack contributors",
+  "timestamp": "2026-08-26T15:32:00+08:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "GO-2026-5932"
+      },
+      "products": [
+        {
+          "@id": "pkg:golang/golang.org/x/crypto@v0.55.0"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "GO-2026-5932 is limited to the discontinued golang.org/x/crypto/openpgp package. Host Provisioner imports only maintained x/crypto primitives used by SSH; the complete vendored package graph contains no openpgp package. Govulncheck reports no imported-package or reachable-code finding."
+    }
+  ]
+}